Analysis
- max time kernel
152s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe
- Size 872KB
- Sample201111-cwyrszn952
- SHA256 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d
- MD5 17a37cac7b4b1b83008e2b293b149155
- SHA1 ee960a8f4d618a99271bb3236fe5a6807a12a63d
- SHA512 f0dcde15c63a47abcfa4e5f4534134835ed4187d578e39f42d755aeee1936ed26ed1811f9960d1572d5d889bf20941b96f04702c3ca9b3c21c67afc48cc8785f
- MD5 SHA1 SHA512
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.vivaldi.net
-
Port
587
-
Username
-
Password
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1172 app.exe 3784 app.exe - Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/1172-21-0x0000000005870000-0x0000000005874000-memory.dmp agile_net - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" app.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Desktop\\app.exe -boot" app.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 whatismyipaddress.com 19 whatismyipaddress.com - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1172 set thread context of 3784 1172 app.exe 84 PID 3784 set thread context of 4040 3784 app.exe 86 PID 3784 set thread context of 3788 3784 app.exe 87 - Suspicious behavior: EnumeratesProcesses 385 IoCs
pid Process 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3788 vbc.exe 3788 vbc.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe Token: 33 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe Token: SeIncBasePriorityPrivilege 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe Token: SeDebugPrivilege 1172 app.exe Token: 33 1172 app.exe Token: SeIncBasePriorityPrivilege 1172 app.exe Token: SeDebugPrivilege 3784 app.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 508 wrote to memory of 3612 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe 78 PID 508 wrote to memory of 3612 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe 78 PID 508 wrote to memory of 3612 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe 78 PID 508 wrote to memory of 416 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe 81 PID 508 wrote to memory of 416 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe 81 PID 508 wrote to memory of 416 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe 81 PID 416 wrote to memory of 1172 416 cmd.exe 83 PID 416 wrote to memory of 1172 416 cmd.exe 83 PID 416 wrote to memory of 1172 416 cmd.exe 83 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 1172 wrote to memory of 3784 1172 app.exe 84 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 4040 3784 app.exe 86 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87 PID 3784 wrote to memory of 3788 3784 app.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe"C:\Users\Admin\AppData\Local\Temp\e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe" "C:\Users\Admin\Desktop\app.exe"2⤵PID:3612
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\app.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\Desktop\app.exe"C:\Users\Admin\Desktop\app.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\Desktop\app.exe"C:\Users\Admin\Desktop\app.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵PID:4040
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵PID:3788
-
-
-
-